Privacy policy.

BRAE Earth Limited, a company registered in England & Wales under company number 15349290, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, trading as fizzgig labs, is the data controller for everything described in this policy (referred to below as “fizzgig”, “we”, “us”, or “our”).

VAT number: GB 456559061. For any privacy question, email sidekick@fizzgig.ai. We don't have a designated DPO - fizzgig is a small enough operation that the founder handles all data-subject requests personally.

• raw source code you scan - only byte counts + which input slots were filled. the synthesis envelope persisted in tool_runs contains finding summaries with redacted snippets, never the surrounding code.
• cookies for tracking. our analytics (plausible + vercel analytics) are both cookieless by design - no persistent identifiers in the browser, no cross-site tracking, no consent banner required under uk ico + eprivacy directive guidance.
• third-party advertising network data. we don't run ads.
• children's data. fizzgig is a developer tool; if you're under 16, please don't use it.

fizzgig uses these third parties to operate. each is listed with what it processes and where it stores data. Article 28 sub-processor disclosure.

• supabase (us-east aws) - database for profiles, api_keys, projects, tool_runs. data processing agreement: supabase dpa.
• cloudflare workers (global edge) - runs every tool. workers don't persist your input - they scan + return findings + forward a privacy-safe summary to the audit log.
• vercel (us / global edge) - hosts the marketing site + dashboard. vercel analytics processes anonymised visit data.
• resend (us) - sends transactional emails (magic links, beta approvals). access to your email address only.
• plausible analytics (eu, frankfurt) - cookieless web analytics. no personal data shared.
• anthropic (us) - only for deep_audit (paid tier). your submitted source code + migrations are sent to anthropic's claude api for review. anthropic's api policy states inputs are not used for model training. acceptable use.
• google (gemini api) (us / global) - only for deep_audit (paid tier). your submitted source code + migrations are sent to google's gemini api for the second-agent review. google's api terms state paid gemini api inputs are not used for training.
• openai (us) - used only for embeddings (the text-embedding-3-small model) that power memory_query and prior_art_scan semantic search. we send the text of your memory titles + descriptions to compute embedding vectors; we do not send raw source code to openai. openai's api terms state api inputs are not used to train their models.

International transfers. BRAE Earth Limited is a UK-established data controller. Some sub-processors listed above (Supabase, Vercel, Cloudflare, Resend, Anthropic, Google, OpenAI) are established in the United States. Where personal data is transferred outside the UK, transfers are protected by one of the following: (a) the UK addendum to the EU Standard Contractual Clauses; (b) the UK-US Data Bridge / EU-US Data Privacy Framework for participating US processors; or (c) an adequacy decision by the UK Secretary of State under Section 17A of the Data Protection Act 2018. You can request the specific transfer mechanism for any listed processor by emailing sidekick@fizzgig.ai.

• active accounts: while your account exists.
• tool runs: 12 months rolling, then auto-purged.
• integration tokens: encrypted-at-rest in fizzgig_vault while the integration is active. hard-purged on account deletion, and available for on-demand hard-purge from /dashboard/integrations (“purge token” button) at any time. hard-purge is irreversible; historical snapshots stay for audit but cannot be refreshed against a purged credential.
• deleted accounts: profile + api keys hard-deleted immediately. integration tokens hard-purged from the vault before the cascade. tool_runs anonymised (user_id set to null) and purged within 30 days. invoices (once payments ship) retained for 7 years per uk tax law.
• waitlist signups: until approved or dismissed, then deleted.

under uk gdpr articles 15-22 you have the right to access, rectify, erase, restrict, port, object to, and not be subject to automated decision-making about your personal data. plus the right to withdraw consent (art 7) and to lodge a complaint with the ICO (art 77).

the per-right detail and how to exercise each:

• right to access - see what we hold on you. self-service via dashboard / profile → export your data.
• right to rectification - correct anything wrong. self-service via dashboard / profile.
• right to erasure (right to be forgotten) - delete your account. self-service via dashboard / profile → delete account.
• right to restriction of processing - ask us to pause processing your data while a query is resolved. email sidekick@fizzgig.ai.
• right to data portability - get your data in a machine-readable format. the export above returns JSON.
• right to object to processing based on legitimate interest (analytics, anti-abuse). email sidekick@fizzgig.ai.
• right to withdraw consent where processing is based on consent (e.g. github username display). email sidekick@fizzgig.ai.
• right to lodge a complaint with the uk ico if you think we've mishandled your data. we'd rather you talk to us first - but it's your right to skip us.

we respond to data-subject requests within 30 days as required by uk gdpr article 12.

we use a small set of strictly-necessary cookies for authentication (supabase session cookies, prefixed sb-). these are exempt from the consent requirement under the eprivacy directive because the site doesn't function without them.

we do not use cookies for analytics - both plausible and vercel analytics are cookieless by design. there is no consent banner because there's nothing to consent to. Full detail in the cookies policy.

The UK regulator for data protection is the Information Commissioner's Office (ICO). You have the right to lodge a complaint with the ICO at any time if you believe we have mishandled your personal data — though we'd appreciate the chance to resolve concerns directly first.

• Website: ico.org.uk
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: 0303 123 1113

we'll update the last updated date at the top and, for any material change, email every active user before it takes effect. policy diff history will live in the repository commit log once we open-source the marketing site.